SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 122,400 - 176,000 / annual
Abnormal AI is seeking a Threat Researcher to join the Threat Intelligence team. This is an analyst role for someone equally interested in understanding threats and making intelligence actionable.
You will conduct original research into active campaigns, attacker behavior, and emerging email and identity attack techniques. You will synthesize research and data from across the Threat Intelligence organization, determine what is meaningful, and transform findings into the right intelligence product for the audience and objective—whether that's a concise threat brief for security practitioners, deeper analytical reports, tailored intelligence for customer QBRs, prospect briefings, webinars, or content supporting sales pursuits.
Key responsibilities include:
**Analyze & Research:** Independently scope and lead complex threat intelligence investigations into active campaigns, attacker behavior, TTPs, and emerging email and identity attack techniques. Use Abnormal's platform, internal telemetry, threat intelligence sources, and external research. Identify meaningful patterns and connections across threat activity. Develop strong understanding of how Abnormal detects and responds to threats you analyze.
**Synthesize Intelligence:** Independently synthesize complex and sometimes conflicting intelligence from disparate sources. Determine the most consequential insights and develop defensible assessments tailored to audience and decision. Translate raw findings into insight, implications, and clear narrative. Adapt depth, framing, and format based on audience. Connect technical threat activity to business risk.
**Create Intelligence Products:** Produce threat briefs, analytical reports, customer QBR content, briefings, webinars, presentations, marketing content, and executive summaries. Create both rapid-turnaround and deeper analytical work. Build reusable narratives and templates. Maintain high standards for sourcing, accuracy, clarity, and editorial quality.
**Engage Customers & Prospects:** Independently lead customer and prospect intelligence engagements, including complex threat briefings, webinars, and presentations. Adapt technical depth in real time and respond to challenging questions. Work with Sales and Customer Success to tailor intelligence. Respond to time-sensitive requests. Develop trusted relationships with customer-facing stakeholders.
**Partner Across Organization:** Collaborate with Threat Intelligence and Detection teams. Serve as technical resource and mentor to P1 and P2 analysts, strengthening analytical judgment through coaching and peer review. Partner with Sales, Customer Success, and Marketing. Provide enablement materials. Feed customer insights back to research teams.
**Work Smarter:** Use AI tools (ChatGPT, Claude, Copilot, etc.) to accelerate research, synthesis, drafting, and editing. Develop practical workflows and automation. Apply appropriate human review to ensure accuracy and analytical rigor.
**Requirements:**
Must Have:
- 4+ years of experience in threat intelligence, SOC operations, or closely related cybersecurity discipline
- Working knowledge of email and identity attack techniques; ability to understand and explain IOCs, TTPs, attack campaigns, and threat behavior
- Demonstrated experience conducting security research and producing written intelligence or security content for different audiences
- Strong ability to synthesize technical research and data from multiple sources into clear intelligence assessments, narratives, and recommendations
- Demonstrated analytical judgment in complex or ambiguous investigations; ability to evaluate incomplete or conflicting evidence and develop defensible assessments with limited direction
- Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts
- Strong writing skills; ability to communicate complex technical subjects clearly and concisely
- Demonstrated ability to independently present complex technical intelligence to customers, executives, security practitioners, or other stakeholders; adapt communication to audience; respond confidently to questions
- Experience working directly with customers or cross-functional stakeholders and translating technical findings into business relevance
- Demonstrated proficiency with AI tools (ChatGPT, Claude, Claude Code, Copilot, or similar) to enhance research, analysis, and writing
- Strong project management and prioritization skills; ability to manage competing requests and deliver high-quality work on time
- Ability to remain calm, accurate, and responsive in high-pressure or time-sensitive situations
- Demonstrated ability to independently scope, prioritize, and deliver complex intelligence work from investigation through final assessment and customer-ready communication
- Ability and willingness to strengthen technical capabilities of other analysts through peer review, knowledge sharing, coaching, and collaborative problem-solving
- Demonstrated use of AI tools or automation to scale research, analysis, or content production
- Working knowledge of MITRE ATT&CK framework and common attack techniques (phishing, BEC, credential harvesting, malware, account takeover); ability to apply to threat research and analysis
- Basic proficiency in SQL, including ability to write and modify queries to retrieve, filter, and analyze datasets in support of threat intelligence research
Nice to Have:
- Experience in email security, phishing detection, anti-abuse systems, or email threat containment
- Experience in detection engineering, incident response, and email security analysis
- Experience with Abnormal Security or similar security platforms
- Public-facing security content experience (published research, blogs, conference talks, webinars, industry reports)
- Experience creating intelligence content for sales cycles, customer QBRs, or customer-facing security engagements
- Experience creating training or enablement materials for Sales, Customer Success, or non-technical teams
- Experience mentoring, coaching, or training earlier-career security analysts
- Experience using Python or other scripting tools to automate data analysis or improve intelligence research workflows
- Security certifications (Security+, GIAC, CISSP, CEH, or similar)
